menubar icon vanished, can't get it back

The fix is simple, but you need to become superuser (root) to edit the file that will fix the problem.  Sophos fixing the file on their next release installer would be the best fix.  I sent an email to Sophos support today and their support person said he'd pass my fix up the support chain.  He also asked me to post it here.

Quick Overview (a short, short explanation of MacOS daemons (servers) and UserAgents):

The application (which Sophos loosely calls is "server") is called SophosUIServer.  It's apparent function in life is to put the Sophos shield part of the Sophos UI on the Mac menubar and then talk to the appropriate (already running) Sophos  server(s) (aka "deamons") to actually handle the request. The actual binary lives within a typical Mac application directory hierarchy located in /Library/Sophos Anti-Virus/SophosUIServer.app.  Unless you've set your Finder to display file extensions, you will only see "SystemUIServer" in the /Library/Sophos Anti-Virus directory folder.  The actual executable binary is actually (as is required for Mac "clickable" applications) in /Library/Sophos Anti-Virus/Contents/MacOS/SophosUIServer.

OS X uses a master daemon (Unix-ese for executables started at boot time) called launchd.  launchd makes a distinction between "LaunchAgents" and "LaunchDaemons".  Generally speaking, a "LaunchDaemon" is a server which provides a service to a program or user.  The Apple developer's manual defines a "LaunchAgent" as

"....essentially identical to a daemon, but is specific to a given logged-in user and executes only while that user is logged in..." (emphasis mine).

Ok, with the above in mind, let's look at the Sophos provided start-up file for SophosUIServer, located in /Library/LaunchAgents (an XML clear text plist file).  [Could get the code insert to work so see the attachment]

The programming error is four lines from the end of the file: <key>RunAtLoad</key>

RunAtLoad tells launchd to start the specifed executable when lauchd itself is started, that is, at system boot time.  By default a program started with RunAtLoad will run as the superuser (root).  Thus, an instance of SophosUIServer is started at system boot before any users are logged in.  It has superuser privileges, could write to any users process (e.g a user's Menubar, but at this time has no user to "talk" to. I am willing to speculate that the instance running as superuser is intermittently playing havoc with the expected per-user instance of SophosUIServer.

The desired behavior is for SophosUIServer to behave like a proper UserAgent:  run when a user logs in, run as the logged-in user, and exit when the user logs out.

What we really have here is a rogue SophosUIServer running as superuser AND an instance of the expected SophosUIServer running for each user.

The Fix: 

Simply delete the line:   <key>RunAtLoad</key> in the file /Library/LaunchAgents/com.sophos.uiserver.plist and reboot your machine (easiest way to restart the inital instance of launchd).

Caveat Emptor!!!:If you've never messed with Unix system software, don't try this at home without an experienced accomplice!!! (or Sophos could provide the fix someday).

Cool.  Yeah, I figured they were misusing LaunchServices considering that all the other launch services have no problem with Finder restarts, but it was quicker to restart SophosUIServer manually than to read the manual and debug the configuration.  So, kudos to you -- I'll fix mine right now.